What are the 4 HIPAA penalty tiers?
Tier 1 (lack of knowledge), Tier 2 (reasonable cause and not willful neglect), Tier 3 (willful neglect, corrected within 30 days), Tier 4 (willful neglect, not corrected). Each has its own minimum, maximum, and annual cap.
Are HIPAA fines per record or per incident?
Each affected individual or each day of non-compliance can count as a separate violation. OCR has discretion — Anthem ($16M for 79M records), Premera ($6.85M for 10.4M records), and Excellus ($5.1M) were all assessed under this multiplier.
Does OCR always go to the maximum?
No. OCR weighs nature/extent of violation, harm to individuals, history of compliance, financial condition, and other factors. Most settlements land well below the cap — but the cap is the ceiling for board-level risk modeling.